s6-applyuidgid when downgrading to non-root user

[maxamel]

Hi, I have a dockerfile which tries downgrading to non-root user and results in this error:

s6-applyuidgid: fatal: unable to set supplementary group list: Operation not permitted

The dockerfile:

FROM woahbase/alpine-lua
WORKDIR /home/alpine
COPY . .
RUN apk add acl curl-dev gcc musl-dev make m4 libffi-dev openssl-dev bsd-compat-headers
RUN luarocks install milua && luarocks install redis-lua && luarocks install lunajson && luarocks install Lua-cURL
RUN chown -hR alpine /run && chown -hR alpine /var/log/ && chown -hR alpine /home/alpine && chown -hR alpine /etc/group
USER alpine
CMD [ "lua", "./src/app.lua" ]

Is there something I'm missing? I also tried creating my user and using the S6 env vars to override the default group/user but that didn't help, and I'd rather keep this simple with the existing alpine user.

[lapnapra]

Hi, sorry for the late reply.

Have you tried without setting the user in Dockerfile? Because the error seems to be at the user-group-modification task where the PUID/PGID/extra-groups is updated. The USER alpine bit is redundant in this case, as the image (being a dev-image using the /usershell entrypoint by default) will drop the effective-UIDGID to be that of the ${S6_USER} anyway (which requires root).

[maxamel]

I tried removing the USER directive. When I run this directly with docker build + docker run the user inside the container appears to be alpine. However, I am running my setup with docker compose. For setting the user correctly in a docker composed setup there are two options: either set the USER directive in the dockerfile or set the user directive in the docker compose file. Both options result in the error:
s6-applyuidgid: fatal: unable to set supplementary group list: Operation not permitted
Not setting any of those results in the user being root.

[lapnapra]

You could do one thing, switch the entrypoint back to /init and set the envvarS6_USER="" (empty quoted string) to disable the usermod-task and privilege-dropping completely.

[maxamel]

Thank you, it appears it worked!